Search the Community

In our last blog post, we talked about some of our security services and how thoroughly we can test your business for Cyber weaknesses. One of the terms we used in that was ‘White Hat Hacker’, to describe ourselves. Now it might seem odd to refer to a high level Cyber security company as ‘hackers’ but in reality, that’s exactly what we do in order to provide you with the best service possible. You see, ‘White Hat hackers’ are just one type of hacker out there and they are the only ones who aren’t dangerous to your business. To illustrate, here’s what each type of hacker ‘Hat’ does: Script Kiddie Script Kiddies don’t really care about hacking into systems and stealing things. They simply copy code and use it for a virus, SQLi or something else. Script Kiddies will never hack for themselves, they will just download some overused software (such as LOIC or Metasploit) and watch a YouTube video on how to use it. A very common Script Kiddie attack would be a DOS (Denial of Service) or DDOS (Distributed Denial of Service), where they flood an IP with so much useless information that it collapses, preventing other people from using it. White Hat White Hat hackers are also known as ethical hackers, and they’re the good guys of the hacker world. They help you remove viruses, perform pen tests and generally help people understand where their vulnerabilities are and fix them. Most White Hat hackers will hold some form of computer or security related qualification, and often pursue careers in hacking and Cyber security. They love the challenge of finding the holes but have no interest in doing anything with them. There are even a number of qualifications specifically for them – Offensive Security Certified Professional (OSCP), CREST Certified Infrastructure Tester and CREST Certified Application Security Tester. Black Hat Black Hat hackers, or ‘crackers’ are the types of people you often hear about on the news and from businesses trying to sell cyber services. They find banks and big companies with weak security systems and steal credit card information, confidential data or money. Their methods are varied but actually fairly basic most of the time. Grey Hat As with everything in this world, nothing is just black and white. Grey Hat hackers don’t steal information or money like Black Hat hackers (though they may sometimes deface a website for fun), nor do they help people out like white hack hackers. Instead, they spend most of their time just playing around with systems, without doing anything harmful. This type of hacker actually makes up most of the hacking community, even though Black hat hackers garner most of the media’s attention. Green Hat Green Hat hackers are the babies of the hacker world. They are new to the game and mainly use script, like Script Kiddies, but they have aspirations of becoming full blown hackers. They are often found asking questions of fellow hackers and listening with childlike curiosity. Red Hat Red Hat hackers are the vigilantes of the hacker world. They’re like white hats in the sense that they put a stop to Black hat attacks, but they are downright scary in how they do it. Instead of reporting the malicious hacker they find lurking inside a business, they shut them down by uploading viruses, DoSing and accessing their computer to destroy it form the inside out. Red hats use many different aggressive methods to force the cracker out and potentially even kill their computer. The good news is, businesses don’t need to worry about these. Blue Hat And finally, we have the Blue Hat hackers. If a Script Kiddie ever took revenge, he would become a Blue Hat Hacker. Blue Hat hackers will seek vengeance on anyone who has made them angry. Most Blue Hat hackers are fairly new to the hacking world, but unlike green hats they have no desire to learn. So hopefully that clears a few things up, and gives you a bit of an insight into the world of hacking in all of its color.

Crackers, hackers, phrackers, phreakers, sneakers: Is there a difference? Here's a primer on hacking nomenclatures to help you keep the bad guys and the good guys straight. Recently, a debate broke out on TechRepublic over the use of the word “hacker” in an article describing DDoS attacks (see "TechRepublic members say the law needs to punish cyber criminals, not the victims"). Member Lee McGrevin, a systems administrator, took exception to that article’s usage of the term “hacker,” stating that the correct term for someone who launches a DDoS attack would be “cracker.” “I am surprised that such a technical-based Web forum would stoop low enough to jump on the bandwagon of the hacker witch hunt,” McGrevin wrote. “Let’s get the record straight for those of us who wear the white hat. A hacker is someone with deep knowledge of how systems work, how to optimize them through noncommercial ways, and [how to] improve the overall quality of programs and [deal with] security-related issues.” McGrevin basically felt that calling those who engage in DDoS attacks “hackers” was demeaning to the hacking community and a hallmark of bad reporting. We certainly regret mislabeling anyone, although in our defense, we’d like it noted that hacking is used generically both in the media and in the IT security field to refer to illegal tampering with systems. So to make sure no other members out there fall into the same trap we did, let’s all take a closer look at this issue. Depends on whom you ask In some ways, the definition of these terms depends upon whom you ask. Take, for example, the following various interpretations of hacking. The National Security Agency (NSA) defines hacking simply as the “unauthorized use, or attempts to circumvent or bypass the security mechanisms of an information system or network.” By comparison, Hackers.com, an underground domain whose stated purpose is to “provide a place for hackers, phone phreaks, and other underground-related people to interact and expand their minds,” offers a somewhat more poetic and gracious definition of hacking: “Hacking is the act of penetrating a closed computer system for the knowledge and information that is contained within. Through the study of technology and computers, a hacker can open his mind and expand his knowledge. Hacking is intended to free information and expand minds, not to be destructive nor for material gain. There is always some debate because of how the term ‘hacker’ has been both glorified and undermined by common media, but most will say that those who destroy data, hack for money, or hack with illegal intent should be referred to as ‘crackers,’ not hackers.” On the other hand, TechRepublic member Edward Clint, a systems administrator for HealthCenter Internet Services, made this important distinction: “No one with a real IT job calls themselves either a hacker or a cracker. …In the real world, we are Security Experts, System Engineers, Network Admins and Architects, and so forth.” A list of terms To help set the record straight, we’ve provided a breakdown of terms and their definitions from the "NSA Glossary of Terms Used in Security and Intrusion Detection." You might also want to visit Information Security Magazine’s online descriptions of "Perpetrator Subtypes." Hacking Unauthorized use, or attempts to circumvent or bypass the security mechanisms of an information system or network. Hacker A person who enjoys exploring the details of computers and how to stretch their capabilities. A malicious or inquisitive meddler who tries to discover information by poking around. A person who enjoys learning the details of programming systems and how to stretch their capabilities, as opposed to most users who prefer to learn only the minimum necessary. Crack A popular hacking tool used to decode encrypted passwords. System administrators also use crack to assess weak passwords by novice users in order to enhance the security of the Automated Information System (AIS). Cracker One who breaks security on an AIS. Automated Information System - any equipment of an interconnected system or subsystems of equipment that is used in the automatic acquisition, storage, manipulation, control, display, transmission, or reception of data and includes software, firmware, and hardware. Samurai A hacker who hires out for legal cracking jobs, snooping for factions in corporate political fights, lawyers pursuing privacy-rights and First Amendment cases, and other parties with legitimate reasons to need an electronic locksmith. Sneaker An individual hired to break in to places in order to test their security; analogous to tiger team. Tiger Team Government and industry-sponsored teams of computer experts who attempt to break down the defenses of computer systems in an effort to uncover, and eventually patch, security holes. Ankle-Biter or Script Kiddies A person who aspires to be a hacker/cracker but has very limited knowledge or skills related to AIS's. Usually associated with young teens who collect and use simple malicious programs obtained from the Internet. Phreaking The art and science of cracking the phone network. Phreak(er) An individual fascinated by the telephone system. Commonly, an individual who uses his knowledge of the telephone system to make calls at the expense of another. Phracker An individual who combines phone phreaking with computer hacking. Hacking Unauthorized use, or attempts to circumvent or bypass the security mechanisms of an information system or network. Hacker A person who enjoys exploring the details of computers and how to stretch their capabilities. A malicious or inquisitive meddler who tries to discover information by poking around. A person who enjoys learning the details of programming systems and how to stretch their capabilities, as opposed to most users who prefer to learn only the minimum necessary. Crack A popular hacking tool used to decode encrypted passwords. System administrators also use crack to assess weak passwords by novice users in order to enhance the security of the Automated Information System (AIS). Cracker One who breaks security on an AIS. Automated Information System - any equipment of an interconnected system or subsystems of equipment that is used in the automatic acquisition, storage, manipulation, control, display, transmission, or reception of data and includes software, firmware, and hardware. Samurai A hacker who hires out for legal cracking jobs, snooping for factions in corporate political fights, lawyers pursuing privacy-rights and First Amendment cases, and other parties with legitimate reasons to need an electronic locksmith. Sneaker An individual hired to break in to places in order to test their security; analogous to tiger team. Tiger Team Government and industry-sponsored teams of computer experts who attempt to break down the defenses of computer systems in an effort to uncover, and eventually patch, security holes. Ankle-Biter or Script Kiddies A person who aspires to be a hacker/cracker but has very limited knowledge or skills related to AIS's. Usually associated with young teens who collect and use simple malicious programs obtained from the Internet. Phreaking The art and science of cracking the phone network. Phreak(er) An individual fascinated by the telephone system. Commonly, an individual who uses his knowledge of the telephone system to make calls at the expense of another. Phracker An individual who combines phone phreaking with computer hacking. We’d like to know: What’s your take on this whole hacker/cracker debate? Is there an important distinction between all of these terms, or is it mere semantics? Post your comments below.